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Abstract 


This document specifies how to use "PKCS #5: Password-Based Cryptography Specification 
Version 2.1" (RFC 8018) to generate a symmetric key from a password in conjunction with the 
Russian national standard GOST algorithms. 


PKCS #5 applies a Pseudorandom Function (PRF) -- a cryptographic hash, cipher, or Hash-Based 
Message Authentication Code (HMAC) -- to the input password along with a salt value and repeats 
the process many times to produce a derived key. 


This specification has been developed outside the IETF. The purpose of publication being to 
facilitate interoperable implementations that wish to support the GOST algorithms. This 
document does not imply IETF endorsement of the cryptographic algorithms used here. 
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This document is not an Internet Standards Track specification; it is published for informational 
purposes. 
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implementation or deployment. Documents approved for publication by the RFC Editor are not 
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Information about the current status of this document, any errata, and how to provide feedback 
on it may be obtained at https://www.rfc-editor.org/info/rfc9337. 
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1. Introduction 


This document provides a specification of usage of GOST R 34.12-2015 encryption algorithms and 
the GOST R 34.11-2012 hashing functions with PKCS #5. The methods described in this document 
are designed to generate key information using the user's password and to protect information 
using the generated keys. 


2. Conventions Used in This Document 


The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD 
NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to 
be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in 
all capitals, as shown here. 


3. Basic Terms and Definitions 


Throughout this document, the following notation is used: 


Notation Definition 


P a password encoded as a Unicode UTF-8 string 

S a random initializing value 

@ a number of iterations of algorithm, a positive integer 

dkLen a length in octets of derived key, a positive integer 

DK a derived key of length dkLen 

Ba a set of all octet strings of length n, n >= 0; if n = 0, then the set Ba consists of an 
empty string of length 0 

A||C a concatenation of two octet strings A, C, i.e., a vector from B |Al+|C)? where the 


left subvector from B Al is equal to the vector A and the right subvector from 


Bic] is equal to the vector C: A = (ay E a,) in BA (ae C= (ho ae, Cy) in By res = 
(a DOCS) Ae ese Ci m B ) 
ny oF ny Gi n,n, 
\xor a bit-wise exclusive-or of two octet strings of the same length 


MSB”: Be a truncating of an octet string to size r by removing the least significant n-r 


n 
S5 octets MSB ami anm ana aa) 
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Notation Definition 


LSB" B,- a truncating of an octet string to size r by removing the most significant n-r 


š n = 
: B, octets: LSB rape an-r+t n-e) =(a 84) 


Int(i) ? ; F oe Woe eae ae hae (oy 
a four-octet encoding of the integer i =< 2°*: Gy, iz ig, ip in By, L=1, + 2 i, + 
16 x; 24 x; 
2 12 ly 
bii, j] a substring extraction operator, extracts octets i through j, 0 =< i =<j 


CEIL(X) the smallest integer greater than or equal to x 


Table 1: Terms and Definitions 


This document uses the following abbreviations and symbols: 


Abbreviations and Definition 
Symbols 
HMAC_GOSTR3411 Hashed-Based Message Authentication Code. A function for 


calculating a Message Authentication Code (MAC) based on the GOST 
R 34.11-2012 hash function (see [RFC6986]) with 512-bit output in 
accordance with [RFC2104]. 


Table 2: Abbreviations and Symbols 


4. Algorithm for Generating a Key from a Password 


The DK is calculated by means of a key derivation function PBKDF2 (P, S, c, dkLen) (see 
[RFC8018], Section 5.2) using the HMAC_GOSTR3411 function as the PRF: 


DK = PBKDF2 (P, S, c, dkLen). 


The PBKDF2 function is defined as the following algorithm: 


1. If dkLen > (232 - 1) * 64, output "derived key too long" and stop. 
2. Calculate n = CEIL (dkLen / 64). 
3. Calculate a set of values for each i from 1 to n: 


U,@ = HMAC_GOSTR3411 (P, S | | INT (i), 
U,@ = HMAC_GOSTR3411 (P, U, (i), 


U.@ = HMAC_GOSTR3411 (P, U._,@), 
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4. 


5. 


TW = U,@ \xor UG) \xor ... \XOr UW. 


Concatenate the octet strings T(i) and extract the first dkLen octets to produce a derived key 
DK: 


° DK = MSB” "64 (T| | T(2)| | ...| | TE) 


dkLen 


Data Encryption 


5.1. GOST R 34.12-2015 Data Encryption 


Data encryption using the DK is carried out in accordance with the PBES2 scheme (see [RFC8018], 
Section 6.2) using GOST R 34.12-2015 in CTR_ACPKM mode (see [RFC8645]). 


5.1.1. Encryption 


The encryption process for PBES2 consists of the following steps: 


N 


Ww 


ui 


1m 


. Select the random value S of a length from 8 to 32 octets. 
. Select the iteration count c depending on the conditions of use (see [GostPkcs5]). The 


minimum allowable value for the parameter is 1000. 


. Set the value dkLen = 32. 
. Apply the key derivation function to the password P, the random value S, and the iteration 


count c to produce a derived key DK of length dkLen octets in accordance with the algorithm 
from Section 4. Generate the sequence T(1) and truncate it to 32 octets, i.e., 


DK = PBKDF2 (BS, c, 32) = MSB™,,,.(T(1)). 


. Generate the random value ukm of size n, where n takes a value of 12 or 16 octets depending 


on the selected encryption algorithm: 


o GOST R 34.12-2015 "Kuznyechik" n = 16 (see [RFC7801]) 
e GOST R 34.12-2015 "Magma" n = 12 (see [RFC8891]) 


. Set the value S' = ukm[1..n-8]. 
. For the id-gostr3412-2015-magma-ctracpkm and id-gostr3412-2015-kuznyechik-ctracpkm 


algorithms (see Section 7.3), encrypt the message M with the GOST R 34.12-2015 algorithm 
with the derived key DK and the random value S' to produce a ciphertext C. 


. For the id-gostr3412-2015-magma-ctracpkm-omac and id-gostr3412-2015-kuznyechik- 


ctracpkm-omac algorithms (see Section 7.3), encrypt the message M with the GOST R 
34.12-2015 algorithm with the derived key DK and the ukm in accordance with the following 
steps: 


o Generate two keys from the derived key DK using the KDF_TREE_GOSTR3411_2012_256 
algorithm (see [RFC7836]): 


encryption key K(1) 
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MAC key K(2) 


Input parameters for the KDF_TREE_GOSTR3411_2012_256 algorithm take the following 
values: 


Kin = DK 
label = "kdf tree" (8 octets) 
seed = ukm[n-7..n] 
R=1 

The input string label above is encoded using ASCII (see [RFC0020)). 


° Compute the MAC for the message M using the K(2) key in accordance with the GOST R 
34.12-2015 algorithm. Append the computed MAC value to the message M: M| | MAC. 


° Encrypt the resulting octet string with MAC with the GOST R 34.12-2015 algorithm with the 
derived key K(1) and the random value S' to produce a ciphertext C. 


9. Serialize the parameters S, c, and ukm as algorithm parameters in accordance with Section 
Baki 


5.1.2. Decryption 
The decryption process for PBES2 consists of the following steps: 


1. Set the value dkLen = 32. 


2. Apply the key derivation function PBKDF2 to the password P, the random value S, and the 
iteration count c to produce a derived key DK of length dkLen octets in accordance with the 
algorithm from Section 4. Generate the sequence T(1) and truncate it to 32 octets, i.e., DK = 


PBKED2 (P, S, c, 32) = MSB™,,..(T(1)). 


Ww 


. Set the value S' = ukm[1..n-8], where n is the size of ukm in octets. 


4. For the id-gostr3412-2015-magma-ctracpkm and id-gostr3412-2015-kuznyechik-ctracpkm 
algorithms (see Section 7.3), decrypt the ciphertext C with the GOST R 34.12-2015 algorithm 
with the derived key DK and the random value S' to produce the message M. 


ui 


. For id-gostr3412-2015-magma-ctracpkm-omac and id-gostr3412-2015-kuznyechik-ctracpkm- 
omac algorithms (see Section 7.3), decrypt the ciphertext C with the GOST R 34.12-2015 
algorithm with the derived key DK and the ukm in accordance with the following steps: 


e Generate two keys from the derived key DK using the KDF_TREE_GOSTR3411_2012_256 
algorithm: 


encryption key K(1) 
MAC key K(2) 


Input parameters for the KDF_TREE_GOSTR3411_2012_256 algorithm take the following 
values: 


Kin = DK 


label = "kdf tree" (8 octets) 
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6. 


seed = ukm[n-7..n] 
R=1 
The input string label above is encoded using ASCII (see [RFC0020)). 
° Decrypt the ciphertext C with the GOST R 34.12-2015 algorithm with the derived key K(1) 


and the random value S' to produce the plaintext. The last k octets of the text are the MAC, 
where k depends on the selected encryption algorithm. 


° Compute the MAC for the text[1..m - k] using the K(2) key in accordance with GOST R 
34.12-2015 algorithm, where m is the size of text. 


° Compare the computing MAC and the receiving MAC. If the sizes or values do not match, 
the message is distorted. 


Message Authentication 


The PBMAC1 scheme is used for message authentication (see [RFC8018], Section 7.1). This scheme 
is based on the HMAC_GOSTR3411 function. 


6.1. MAC Generation 
The MAC generation operation for PBMAC1 consists of the following steps: 


eS 


Ww 


ul 


(op) 


s 


. Select the random value S of a length from 8 to 32 octets. 
. Select the iteration count c depending on the conditions of use (see [GostPkcs5]). The 


minimum allowable value for the parameter is 1000. 


. Set the dkLen to at least 32 octets. The number of octets depends on previous parameter 


values. 

Apply the key derivation function to the password P, the random value S, and the iteration 
count c to generate a sequence K of length dkLen octets in accordance with the algorithm 
from Section 4. 


- Truncate the sequence K to 32 octets to get the derived key DK, i.e., DK = igp ELEN AR, 


. Process the message M with the underlying message authentication scheme with the derived 


key DK to generate a message authentication code T. 


. Save the parameters S and c as algorithm parameters in accordance with Section 7.4. 


6.2. MAC Verification 


The MAC verification operation for PBMAC1 consists of the following steps: 


1. 


2. 


Set the dkLen to at least 32 octets. The number of octets depends on previous parameter 
values. 

Apply the key derivation function to the password P, the random value S, and the iteration 
count c to generate a sequence K of length dkLen octets in accordance with the algorithm 
from Section 4. 
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3. Truncate the sequence K to 32 octets to get the derived key DK, i.e., DK = rsp): 


4. Process the message M with the underlying message authentication scheme with the derived 
key DK to generate a MAC. 

5. Compare the computing MAC and the receiving MAC. If the sizes or values do not match, the 
message is distorted. 


7. Identifiers and Parameters 


This section defines the ASN.1 syntax for the key derivation functions, the encryption schemes, 
the message authentication scheme, and supporting techniques (see [RFC8018]). 


rsadsi OBJECT IDENTIFIER :: 
pkcs OBJECT IDENTIFIER ::= 
pkcs-5 OBJECT IDENTIFIER : 


{ iso(1) member-body(2) us(840) 113549 } 
rsadsi 1 
{ pkcs 5 } 


I~ Il 


7.1. PBKDF2 
The Object Identifier (OID) id-PBKDF2 identifies the PBKDF2 key derivation function: 


id-PBKDF2 OBJECT IDENTIFIER ::= { pkcs-5 12 } 


The parameters field associated with this OID in an AlgorithmIdentifier SHALL have type 
PBKDF2-params: 


PBKDF2-params ::= SEQUENCE 
{ 
salt CHOICE 
{ 
specified OCTET STRING, 
otherSource AlgorithmIdentifier {{PBKDF2-SaltSources}} 
a 
iterationCount INTEGER (10@@..MAX), 
keyLength INTEGER (32..MAX) OPTIONAL, 
prf AlgorithmIdentifier {{PBKDF2-PRFs}} 
} 


The fields of type PBKDF2-params have the following meanings: 


e salt contains the random value S in OCTET STRING. 
e iterationCount specifies the iteration count c. 


e keyLength is the length of the derived key in octets. It is an optional field for the PBES2 
scheme since it is always 32 octets. It MUST be present for the PBMAC1 scheme and MUST be 
at least 32 octets since the HMAC_GOSTR3411 function has a variable key size. 
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e prf identifies the pseudorandom function. The identifier value MUST be id-tc26-hmac- 
gost-3411-12-512 and the parameters value must be NULL: 


id-tc26-hmac-gost-3411-12-512 OBJECT IDENTIFIER ::= 


iso(1) member-body(2) ru(643) reg7(7) 
tk26(1) algorithms(1) hmac(4) 512(2) 


7.2. PBES2 
The OID id-PBES2 identifies the PBES2 encryption scheme: 


id-PBES2 OBJECT IDENTIFIER ::= { pkcs-5 13 } 


The parameters field associated with this OID in an AlgorithmIdentifier SHALL have type PBES2- 
params: 


PBES2-params ::= SEQUENCE 
{ 


keyDerivationFunc AlgorithmIdentifier { { PBES2-KDFs } }, 
encryptionScheme AlgorithmIdentifier { { PBES2-Encs } } 


The fields of type PBES2-params have the following meanings: 


e keyDerivationFunc identifies the key derivation function in accordance with Section 7.1. 
e encryptionScheme identifies the encryption scheme in accordance with Section 7.3. 


7.3. Identifier and Parameters of Gost34.12-2015 Encryption Scheme 


The Gost34.12-2015 encryption algorithm identifier SHALL take one of the following values: 


id-gostr3412-2015-magma-ctracpkm OBJECT IDENTIFIER ::= 


iso(1) member-body(2) ru(643) rosstandart(7) 
tc26(1) algorithms(1) cipher(5) 
gostr3412-2015-magma(1) mode-ctracpkm(1) 


When the id-gostr3412-2015-magma-ctracpkm identifier is used, the data is encrypted by the 
GOST R 34.12-2015 Magma cipher in CTR_LACPKM mode in accordance with [RFC8645]. The block 
size is 64 bits and the section size is fixed within a specific protocol based on the requirements of 
the system capacity and the key lifetime. 
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id-gostr3412-2015-magma-ctracpkm-omac OBJECT IDENTIFIER ::= 


iso(1) member-body(2) ru(643) rosstandart(7) 
tc26(1) algorithms(1) cipher(5) 
gostr3412-2015-magma(1) mode-ctracpkm-omac(2) 


When the id-gostr3412-2015-magma-ctracpkm-omac identifier is used, the data is encrypted by 
the GOST R 34.12-2015 Magma cipher in CTR_ACPKM mode in accordance with [RFC8645] and the 
MAC is computed by the GOST R 34.12-2015 Magma cipher in MAC mode (MAC size is 64 bits). The 
block size is 64 bits and the section size is fixed within a specific protocol based on the 
requirements of the system capacity and the key lifetime. 


id-gostr3412-2015-kuznyechik-ctracpkm OBJECT IDENTIFIER ::= 
{ 


iso(1) member-body(2) ru(643) rosstandart(7) 
tc26(1) algorithms(1) cipher(5) 
gostr3412-2015-kuznyechik(2) mode-ctracpkm(1) 


When the id-gostr3412-2015-kuznyechik-ctracpkm identifier is used, the data is encrypted by the 
GOST R 34.12-2015 Kuznyechik cipher in CTR_LACPKM mode in accordance with [RFC8645]. The 
block size is 128 bits and the section size is fixed within a specific protocol based on the 
requirements of the system capacity and the key lifetime. 


id-gostr3412-2015-kuznyechik-ctracpkm-omac OBJECT IDENTIFIER ::= 


iso(1) member-body(2) ru(643) rosstandart(7) 
tc26(1) algorithms(1) cipher(5) 
gostr3412-2015-kuznyechik(2) mode-ctracpkm-omac(2) 


When the id-gostr3412-2015-kuznyechik-ctracpkm-omac identifier is used, the data is encrypted 
by the GOST R 34.12-2015 Kuznyechik cipher in CTR_-ACPKM mode in accordance with [RFC8645] 
and MAC is computed by the GOST R 34.12-2015 Kuznyechik cipher in MAC mode (MAC size is 128 
bits). The block size is 128 bits and the section size is fixed within a specific protocol based on the 
requirements of the system capacity and the key lifetime. 


The parameters field in an AlgorithmIdentifier SHALL have type Gost3412-15-Encryption- 
Parameters: 


Gost3412-15-Encryption-Parameters ::= SEQUENCE 


ukm OCTET STRING 
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The field of type Gost3412-15-Encryption-Parameters have the following meanings: 


e ukm MUST be present and MUST contain n octets. Its value depends on the selected 
encryption algorithm: 


o GOST R 34.12-2015 "Kuznyechik" n = 16 (see [RFC7801]) 
e GOST R 34.12-2015 "Magma" n = 12 (see [RFC8891]) 


7.4. PBMAC1 
The OID id-PBMAC1 identifies the PBMAC1 message authentication scheme: 


id-PBMAC1 OBJECT IDENTIFIER ::= { pkcs-5 14 } 


The parameters field associated with this OID in an AlgorithmIdentifier SHALL have type 
PBMAC1-params: 


PBMAC1-params ::= SEQUENCE 
{ 


keyDerivationFunc AlgorithmIdentifier { { PBMAC1-KDFs } }, 
messageAuthScheme AlgorithmIdentifier { { PBMAC1-MACs } } 


The fields of type PBMAC1-params have the following meanings: 


e keyDerivationFunc is the identifier and parameters of key derivation function in accordance 
with Section 7.1. 


e messageAuthScheme is the identifier and parameters of the HMAC_GOSTR3411 algorithm. 


8. Security Considerations 


For information on security considerations for password-based cryptography, see [RFC8018]. 


Conforming applications MUST use unique values for ukm and S in order to avoid the encryption 
of different data on the same keys with the same initialization vector. 


It is RECOMMENDED that parameter S consist of at least 32 octets of pseudorandom data in order 
to reduce the probability of collisions of keys generated from the same password. 


9. IANA Considerations 


This document has no IANA actions. 
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Appendix A. PBKDF2 HMAC_GOSTR3411 Test Vectors 


These test vectors are formed by analogy with test vectors from [RFC6070]. The input strings 
below are encoded using ASCII (see [RFC0020]). The sequence "\0" (without quotation marks) 
means a literal ASCII NULL value (1 octet). "DK" refers to the derived key. 


C = 
dkLe 


Output: 
DK = 


Input: 
P 
S 


Cc 
dkLe 


Output: 
DK = 


Input: 
P 
S 


Cc 
dkLe 


Output: 
DK = 


Karelina 


editor.org/info/rfc6070>. 


"password" (8 octets) 
"salt" (4 octets) 


64 77 0a f7 f7 48 c3 
61 11 b3 0a 8a 65 7d 
28 54 fd 36 81 1f 6d 
90 a9 e5 cf 51 56 b3 


"password" (8 octets) 
"salt" (4 octets) 

2 

n = 64 


5a 58 5b af df bb 6e 
Əd 2e 4a eb ce 01 c9 
d3 4b 2b 8f bd 2c 4e 
pa es191r57 17 43 IN 


"password" (8 octets) 
"salt" (4 octets) 
4096 

n = 64 


e5 2d eb 9a 2d 2a af 
03 76 59 Ic 67 80 7f 
86 7c 09 84 1b 6d 58 
df Od 34 e4 7c f6 8f 


"password" (8 octets) 
"salt" (4 octets) 
16777216 

n = 64 


49 e4 84 3b ba 76 e3 
de f1 2f 2c ðe 24 41 


b1 
dc 
82 
a2 


88 
b3 
89 
9e 


f4 
04 
e2 
4e 


00 
T2 


c9 
30 
5e 
b7 


30 
1c 
d5 
8d 


e2 
Te, 
9d 
3C 


af 
36 


ac 
56 
c4 
ee 


d6 
ZC 
Ad 
SC 


ac 
e3 
63 
2¢ 


e2 
7e 


83 
b8 
ab 
cd 


d6 
ae 
46 
42 


9d 
25 
47 
da 


4c 
d7 


1d 
Oc 
66 
db 


8a 
d5 
5 
ba 


47 
49 
c9 
fi 


4d 
ða 


Informational 


bc 
a7 
ec 
f9 


a3 
6f 
Be 
66 


a4 
de 
96 
d9 


23 
89 


fd 
3e 
ða 
al 


b4 
02 
47 
d3 


1f 
34 
30 
ab 


de 
82 


85 
04 
68 
6b 


3a 
36 
d4 
48 


34 
1b 
1d 
86 


73 
ac 


C2. 
Od 
a4 
47 


cO 
d4 
5b 
de 


C2 
c7 
55 
c3 


92 
36 
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GOST Password-Based Keys 


la db 60 1c 7e 2a 31 4e 8c b7 b1 e9 df 84 
ab 56 15 be 5d 74 2b 6c f2 03 fb 55 fd c4 


RFC 9337 
Input: 
P= 
Se 
c = 4096 
dkLen = 
Output: 
DK = b2 
07 
4b 
f3 
bd 
33 
2b 
Input: 
P= 
SiS 
c = 4096 
dkLen = 
Output: 


100 


d8 
53 
ee 
95 
24 
f9 
aa 


64 


f1 
aa 
9a 
c8 
21 
e2 
2d 


24 
22 
dd 
93 
ee 
7d 
3a 


5f 
fic 
ca 
87 
9b 
c6 


c4 
53 
e9 
de 
b7 
17 


d2 
76 
9b 
94 
11 
8C 


92 
Ob 
a2 
5a 
83 
b8 


"pass\ðword" (9 octets) 
"sa\@lt" (5 octets) 


DK = 50 df 06 28 85 b6 98 01 
6e 52 2f fe b2 Oc 99 1c 
16 7f 78 2c 18 e9 7e 92 
78 cc b8 79 f6 78 68 cd 


Acknowledgments 


74 
30 
bð 
ed 
ba 
9d 


a3 
66 
97 
ac 


80 
lic 
b2 
ec 
88 
c3 


c1 
Of 
6d 
19 


20 
fO 
Of 
a6 
ZC 
74 


02 
(217) 
9c 
190 


57 
68 
43 
eb 
ee 
28 


48 
14 
1d 
74 


"passwordPASSWORDpassword" (24 octets) 
“saltSALTsaltSALTsaltSALTsaltSALTsalt" (36 


e4 
67 
la 
40 
bf 
Cit 


eb 
15 
97 
08 


b5 
9e 
9c 
aS 
ef 
9c 


ða 
d7 
08 
44 


Be 
80 


octets) 


4e 
58 
5e 
df 
25 
C5 


27 
3a 
31 
e8 


36 
71 


ða 
fe 
50 
C2 
9f 
2a 


ab 
4e 
ea 
30 
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